/var/log/bind9/** rw,
/var/log/bind9/ rw,

options {
        directory "/var/cache/bind";
        auth-nxdomain no;
        listen-on-v6 { any; };
        statistics-file "/var/cache/bind/named.stats";
        rrset-order {order cyclic;};
    allow-transfer {; };
logging {
        channel b_query {
                file "/var/log/bind9/query.log" versions 2 size 1m;
                print-time yes;
                severity info;
        category queries { b_query; };

service bind9 status

isc_stdio_open '/var/log/bind9/query.log' failed: permission denied

I have already created bind9 in /var/log and added root:bind with permission 755

I have already restarted apparmor and bind9 Same error. What is wrong ?

3 Answers 3


On /etc/apparmor.d/usr.sbin.named

/var/log/named/** rw,
/var/log/named/ rw,

You must adjust permissions or dir here.

Some people like to put logs in /var/log/named/ instead of having syslog do the heavy lifting.

  • Thanks! This saved my day after upgrading ubuntu on my raspberrypi 2b+ from 18.04.4 xeinal to 20.04 focal Apr 26, 2020 at 19:08

I tried to configure custom logging, "/var/log/named/log.files.names".

I tried everything that seamed reasonable to get rid of the error, "isc_file_isplainfile '/var/log/named/default' failed: permission denied" by changing the file system permissions without success. I then tried to make the named log files and directory executable and couldn't believe it, that fixed the permissions. Apparently bind needs to execute something using these files and/or directory.

owner=root:group=named and permissions are 775.

p.s: Zanna, you should take your own advice about editing other people's posts. Unless you absolutely know what they're trying to say and not thinking you know, even the most minuscule change you make in their grammar can profoundly change the meaning of their post.

  • 1
    If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review
    – fosslinux
    May 21, 2018 at 22:42
  • 4
    @ubashu: This looks like an answer to me albeit with a rather unnecessary introduction. May 21, 2018 at 23:04

I have already created bind9 in /var/log and added root:bind with permission 755

instead of root:bind, bind:bind works

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.